fixed some bugs

static/teacher.html

@@ -26,11 +26,33 @@
         <input id="password" type="password" autocomplete="current-password" required>
         <button class="full" data-working type="submit">登录后台</button>
         <div class="notice" id="loginNotice"></div>
-        <p class="hint">默认账号 teacher，默认密码 teacher123。正式使用前请通过环境变量修改。</p>
+        <p class="hint">默认账号 teacher，默认密码 teacher!@#。首次使用后请及时修改密码。</p>
       </form>
     </div>
 
     <div id="mainArea" class="hidden">
+      <section class="panel">
+        <div class="section-head"><h2>账号安全</h2></div>
+        <form class="form-line" id="teacherPasswordForm">
+          <input id="teacherOldPassword" type="password" autocomplete="current-password" placeholder="原密码" required>
+          <input id="teacherNewPassword" type="password" autocomplete="new-password" minlength="8" placeholder="新密码（至少 8 位）" required>
+          <input id="teacherConfirmPassword" type="password" autocomplete="new-password" minlength="8" placeholder="确认新密码" required>
+          <button data-working type="submit">修改密码</button>
+        </form>
+        <div class="notice" id="teacherPasswordNotice"></div>
+      </section>
+
+      <section class="panel">
+        <div class="section-head"><h2>分组设置</h2></div>
+        <form class="form-line" id="groupLimitForm">
+          <input id="groupLimit" type="number" min="2" max="100" required>
+          <span>人</span>
+          <button data-working type="submit">保存上限</button>
+        </form>
+        <p class="hint">调整后立即对所有班级生效；已有小组不会被自动拆分。</p>
+        <div class="notice" id="groupLimitNotice"></div>
+      </section>
+
       <section class="panel">
         <div class="section-head">
           <h2>班级管理</h2>

static/teacher.js

@@ -12,6 +12,7 @@ function renderState() {
   el('mainArea').classList.remove('hidden');
   el('teacherToolbar').classList.remove('hidden');
   el('teacherChip').textContent = `教师：${state.username}`;
+  el('groupLimit').value = state.snapshot.group_limit;
   renderClassTabs();
   renderStatistics();
   renderGroups();
@@ -166,6 +167,41 @@ async function submitLogin(event) {
   }
 }
 
+async function submitTeacherPassword(event) {
+  event.preventDefault();
+  const oldPassword = el('teacherOldPassword').value;
+  const newPassword = el('teacherNewPassword').value;
+  const confirmPassword = el('teacherConfirmPassword').value;
+  const notice = el('teacherPasswordNotice');
+  notice.textContent = '';
+  if (newPassword !== confirmPassword) {
+    notice.textContent = '两次输入的新密码不一致';
+    return;
+  }
+  setButtonsDisabled(el('teacherPasswordForm'), true);
+  const result = await api('teacher/change-password', {
+    method: 'POST', json: { old_password: oldPassword, new_password: newPassword }
+  });
+  setButtonsDisabled(el('teacherPasswordForm'), false);
+  notice.textContent = result.ok ? '' : result.message;
+  toast(result.message, !result.ok);
+  if (result.ok) {
+    el('teacherPasswordForm').reset();
+  }
+}
+
+async function submitGroupLimit(event) {
+  event.preventDefault();
+  setButtonsDisabled(el('groupLimitForm'), true);
+  const result = await api('teacher/group-limit', {
+    method: 'POST', json: { limit: Number(el('groupLimit').value) }
+  });
+  setButtonsDisabled(el('groupLimitForm'), false);
+  el('groupLimitNotice').textContent = result.ok ? '' : result.message;
+  toast(result.message, !result.ok);
+  if (result.ok) await loadState();
+}
+
 async function switchClass(className) {
   const result = await api('teacher/class', { method: 'POST', json: { class_name: className } });
   toast(result.message, !result.ok);
@@ -211,6 +247,8 @@ async function logout() {
 }
 
 el('loginForm').addEventListener('submit', submitLogin);
+el('teacherPasswordForm').addEventListener('submit', submitTeacherPassword);
+el('groupLimitForm').addEventListener('submit', submitGroupLimit);
 el('logoutButton').addEventListener('click', logout);
 el('lockButton').addEventListener('click', toggleLock);
 el('createGroupForm').addEventListener('submit', submitCreateGroup);